Prevent XSS exploits misusing the site_url system setting